Element · 01
Gap Analysis
Assess your current ISMS, controls and evidence against ISO/IEC 27001 requirements. Receive a prioritized gap report with owners and a practical remediation roadmap.
ISO/IEC 27001Gap Analysis → Stage 2US & Canada
ISO 27001 Consulting
ISO 27001 Consultant: Certification Readiness
Gap analysis, ISMS implementation and internal audit to get you ready for ISO/IEC 27001 certification — US & Canada.
US & Canada
Overview
Why ISO 27001
Customer and procurement requirements increasingly ask for evidence that information security is managed, not just promised.
ISO/IEC 27001 provides a risk-based framework for an information security management system (ISMS). Customer contracts, supplier qualification and security questionnaires may ask for certification or evidence of defined controls, accountable owners and ongoing review. We help you identify the requirements that apply to your scope, build usable processes and assemble audit evidence. Certification does not replace customer-specific requirements or guarantee that incidents will not occur.
What’s included
Our services
Element · 02
ISMS Implementation
Define scope and interested-party requirements; develop risk assessment and risk treatment, a Statement of Applicability, policies and operational records. Build ownership, monitoring and management review into everyday work.
Element · 03
Internal Audit
Plan and conduct an evidence-based internal audit with appropriate independence. Document findings and support corrective action so the audit tests implementation, not just the presence of policies.
Element · 04
Certification Readiness
Review scope, documentation and preparedness before Stage 1, then test operating evidence and corrective-action closure before Stage 2. Your accredited certification body conducts the certification audits and decides certification.
Readiness roadmap
How it works
Four steps from understanding your scope to preparing for an independent certification audit.
- STEP 01Scope & assess
Confirm business objectives, customer requirements, system boundaries and current maturity. Agree the gap analysis and work plan.
- STEP 02Build & implement
Establish risk assessment, treatment, the Statement of Applicability and policies. Put selected controls into practice with accountable owners.
- STEP 03Audit & improve
Conduct the internal audit and management review, address findings and retain evidence that the ISMS is operating.
- STEP 04Prepare for Stage 1 & 2
Check documentation for Stage 1 and implementation evidence for Stage 2. Support responses to findings without making the certification decision.
Business outcomes
Where the value lands.
- Clear, evidence-based responses to customer security questionnaires and procurement reviews.
- An ISMS matched to your information risks and business scope.
- Documented control ownership, review and corrective action.
- A prepared team and organized evidence for Stage 1 and Stage 2.
What you receive
Deliverables
- 01ISMS scope and prioritized gap analysis report
- 02Risk assessment methodology, risk register and risk treatment plan
- 03Statement of Applicability with control selection and justification
- 04Policies, procedures and implementation evidence register
- 05Internal audit report and corrective-action tracker
- 06Management review records and Stage 1 / Stage 2 readiness checklist
Aligned to
ISO/IEC 27001:2022ISO/IEC 27002:2022
FAQ
Frequently Asked Questions
ISO 27001 consulting and certification readiness across the US and Canada.
What drives ISO 27001 consulting and certification costs?
Scope, number of sites, headcount, technology complexity, current control maturity and the amount of remediation drive consulting effort. Certification-body audit fees are separate and depend on the body's assessment of your scope and audit requirements. We provide a written quote after reviewing your needs; we do not publish a one-size-fits-all price.
How long does ISO 27001 readiness take?
The timeline depends on your starting point, scope, available staff and how quickly controls can be implemented and evidenced. An established management system may need less preparation than an organization starting from scratch. We agree a realistic roadmap after gap analysis; certification-body availability and remediation may affect the final audit schedule.
Do you certify?
No — certificates are issued by accredited certification bodies; we prepare you. Jags Assurance supports gap analysis, ISMS implementation, internal audit and certification readiness. The certification body independently conducts Stage 1 and Stage 2 and makes the certification decision.
What is the difference between ISO 27001 and SOC 2?
ISO/IEC 27001 is a certifiable international standard for an information security management system. SOC 2 is an independent CPA attestation report against applicable Trust Services Criteria; a Type 2 report evaluates control operation over a defined period. They can share evidence and controls, but neither automatically replaces the other. Customer and procurement requirements determine which is appropriate.
Can ISO 27001 be mapped to ISO 42001?
Yes. ISO/IEC 27001 and ISO/IEC 42001 share management-system elements such as context, leadership, risk assessment, internal audit and management review. We can map shared processes and evidence while identifying separate requirements. ISO 42001 addresses AI management, including AI-specific risks and impacts; ISO 27001 focuses on information security. One certification does not confer the other.
Request a Quote
Written quote within two business days
Tell us your ISMS scope, current maturity and target audit date. We will provide a written quote within two business days.
Get in touch
Request a QuoteWritten quote within two business days
Tell us your ISMS scope, current maturity and target audit date. We will provide a written quote within two business days.